Internal Audit Six-Month Audit Follow-up Report 
Executive Summary 
UM 

We performed follow-up procedures to determine the status of management's 
responses to previously issued audit reports with action items that were due to have 
remediation completed between February 1, 2012 and July 15, 2012. These items are 
reflected in the report as either "closed" or "past due". Items listed as "in process" are 
action items from previously issued audit reports that were not scheduled to have 
remediation completed before July 15, 2012. 

We requested auditees to document the current status of their action items due on 
Implementation Status Summary (ISS) forms. These ISS forms are reviewed by the 
respective Internal Audit Steering Committee Representative (ASCR) to help ensure 
quality and then are returned to Internal Audit. We then performed fieldwork on 
approximately 50% of the action items due to independently validate the status of 
items as reported by management. 

The following summarizes the results of the procedures Internal Audit and the ASCR 
performed to assess the current status of outstanding audit findings designated as 
"High" or "Medium" risk for internal audit reports. Audit findings designated as 
"Low" risk are not subject to follow-ups but management is required to submit a 
status of "closed", "past due" or "in process" for these items. 

We will be reporting on 5 1 action items that were due to have remediation completed 
between February 1, 2012 and July 15, 2012. The status of these items is reflected 
below: 

• For High and Medium risk action items scheduled for completion on or before 
July 15, 2012: 

o 36 items, or 71% are considered closed 

o 15 items, or 29% are considered to be past due 

• The following page depicts the summary results in tabular form. In addition to 
the High and Medium risk items referenced above, the table also includes Low 
risk items and "in process" action items. 

• A summary for each High and Medium risk past due actions item has been 
included for your consideration. 

• Detailed information for each High and Medium risk action item is included in the 
full follow-up report by business unit and action item status; this report is 
available upon request from the Office of the Vice President for Finance and 
Administration. 
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Summary of Action Items by Audit Report as of July 15, 2012 



Unit 


Report Name 


Past Due 


Closed 


In Process 1 






H 


M 


L 


H 


M 


L 


H 


M 


L 




Data Retention Assessment 




















UM 


Human Resources PreTmplementation Assessment 




4 
















System-wide 


501(c)(3) Governance Assessment 


- 








2 










Financial Aid Assessment 


- 








2 












Procure-to-Pay Review 


- 








1 






1 






Information Technology Spend Review 
















4 






Emergency Preparedness Assessment 














5 






Division of Information Technology Project Management Office 










1 










UM System 


Non- Vested Pension Benefits 










2 










Board of Curators Expenses Review 












3 




1 






Healthcare Provider Discounts 
















4 




MU 


College of Education 










1 










Hatch Act Formula Grant 










1 








1 




College of Arts and Sciences - High School/College Partnerships (HSCP) 










1 


2 I 3 


2 


1 


UMKC 


School of Law 










3 












Scholarships and Tuition Waivers Review 
















4 


1 




Human Resources 










1 


l 










Physical Facilities 2 










2 










S&T 


Office of the Vice Provost for Academic Affairs 


~_ 


1 


. 


~_ 










~_ 




Office of the Vice Chancellor for Advancement 










1 






1 






Cashier's Office Internal Audit 










2 


2 










Division of Institutional Safety 2 










1 












Touhill Performing Arts Center 










1 










UMSL 


Advanced Credit Program 










2 












College of Education 












1 




6 






Department of Athletics 
















2 


3 




University Physicians - Physician Documentation 




1 


















MUHS ICD-10 Internal Audit Analysis 




2 
















MUHS 


MUHS Graduate Medical Education 










1 










MUHS Tiger Institute 










1 


1 ^™ 


2 






MUHC Inventory Optimization Assessment 
















l 


TOTAL 


7 


8 


1 


10 


26 


13 


8 


38 


9 



Items listed as "in process" are action items from previously issued audit reports that were not scheduled to have remediation completed before July 15, 2012. 
" Audit findings include items to be remediated at the system level. 
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Summary of Past Due Action Items by Audit Report 
As of July 15, 2012 ' 



As illustrated in the chart, on the previous page, 7 "High" and 8 "Medium" risk action items are overdue for implementation. A brief 
status update for each of the overdue action items is provided below. 



Unit & 


Audit Report 


Risk 




UM 


UM System 


System- 


Human 


wide 


Resources Pre- 




Implementation 


Risk: 


Assessment, 




May 2010 




Report 




Observation: la 



Summary of Action Item 



UM Human Resources (HR) will partner with the UM 
Division of Finance & Administration and work with 
campus departments to eliminate the number of approvals 
required for transaction processing. UM HR/Payroll is 
committed to increase the use of technology to drive faster 
processing times, reduce the amount of paper, and to 
improve efficiencies. Specifically, HR will explore the use 
of PeopleSoft "workflow" technology as part of the 
PeopleSoft HR upgrade to automate the approval process. 
Workflow functionality will provide business process 
transparency and allow HR to mitigate bottlenecks that 
impede transaction progression. 



Due Date Status Update 



7/34 The Implementation of Commitment Accounting will 
3/3-2 provide ways to improve the efficiency of funding data 
6/3-2 entry and approval. HR anticipates utilizing two new 
6/13 processes, Approval Work Flow and Manager Self 
Service, to electronically channel items for approval. 
During this process and as the result of other ongoing 
activities, the number of approvals will be under 
examination. Initial implementation is scheduled for 
January 2013 with additional forms and processes to 
be included over time. The ePAF will be developed by 
a third party and will be fully integrated into the 
PeopleSoft system. This product has the capability to 
be extended, via additional licenses, to Student and 
Finance. 



September 13-14, 2012 

OPEN - AUD - INFO 1-8 

This information has been prepared solely for the use and benefit of the 
University of Missouri and is not intended for reliance by any other person. 



# 


Unit & 
Risk 


Audit Report 


Summary of Action Item 


Due Date 


Status Update 


2 


UM 

System- 
wide 

Risk: 


Human 

Resources Pre- 
Implementation 
Assessment, 
May 2010 

Report 

Observation: lb 


The full implementation of the eRecruit module in 
PeopleSoft will eliminate the need for data entry of new 
hire personal data. Other personnel actions can be input 
directly into the system through the Manager Self Service 
technology. UM HR is currently exploring the most 
efficient way to implement this technology. We will 
utilize the information provided through the Shared 
Services Benchmarking Project to determine whether 
centralization or de-centralization is the most efficient way 
to input directly into the system. Our goal is to eliminate 
transaction complexities for end users, eliminate paper 
processes, increase efficiency through reduced processing 
times, and improve HR services. 


6/13 


The upgrade took place in July 201 1, as planned. We 
are actively implementing Global Grading Codes 
which is a necessary condition for expanded eRecruit 
functionality and Talent Management. Full adoption 
of the eRecruit tool is expected by June 30, 2013. 

All campuses should have fully adopted the eRecruit 
application by the end of this year. The exception is 
the Hospital which has recently chosen to use different 
technology. An electronic version of the PAF is being 
developed by a third party. Initial implementation is 
scheduled for January 2013. 


3 


UM 
System- 
wide 

Risk: 


Human 

Resources Pre- 
Implementation 
Assessment, 
May 2010 

Report 

Observation: lc 


In addition to the automation allowed for in eRecruit, the 
planned upgrade to PeopleSoft version 9.1 in July of 201 1, 
will also allow HR to take advantage of new functionality 
delivered for a myriad of paper intensive compliance 
processes such as management of 1-9 information, 
automated third party integrations for Criminal 
Background Checks, and the use of Smart Hire Templates 
for hiring student employees. 


42740 
42744- 
5/io 

6/13 


The upgrade took place in July 201 1, as planned. All 
campuses will have full implementation of eRecruit by 
the end of calendar 2012. The Hospital has chosen to 
adopt different technology and is just starting the 
investigation into what third party solution they would 
like to adopt. 


4 


UM 
System- 
wide 

Risk: 
Medium 


Human 

Resources Pre- 
Implementation 
Assessment, 
May 2010 

Report 

Observation: 2 


HR will set consistent university-wide standards for timely 
processing and payment of new hires and termination of 
employees. Campus HR offices will track achievement of 
these standards, benchmark time to complete these 
business processes and develop processes to hold campus 
departments accountable. 


42740 
g/j \ 

5/io 
6/13 


The upgrade took place in July 201 1, as planned. We 
are planning to implement a Smart Hire template for 
Student employees and allow departments to process 
terminations through Manager Self Service (MSS) 
rather than a paper PAF. We have provided access to 
the system for new employees and HR 30 days prior to 
hire date. 



September 13-14, 2012 

OPEN - AUD - INFO 1-9 

This information has been prepared solely for the use and benefit of the 
University of Missouri and is not intended for reliance by any other person. 



# Unit & Audit Report Summary of Action Item Due Date Status Update 

Risk 



5 


UM 

System- 
wide 

Risk: 
Medium 


Human 

Resources Pre- 
Implementation 
Assessment, 
May 2010 

Report 

Observation: 3 


The campuses will develop or enhance communication 
plans regarding the importance of timely processing of all 
personnel actions and emphasize the problems created by 
hires and terminations which are not processed timely. HR 
will work to identify legitimate constraints faced by 
departments in processing the paperwork, and develop or 
enhance enforcement efforts. In addition campuses will 
document the problems caused by delays in processing 
hires and in terminations and use that information to secure 
the support from all levels of administration in improving 
timelines for processing critical personnel actions. System 
HR will develop an edit report to be distributed to the 
campuses detailing transactions that fall outside the 
established benchmarks for timely transaction processing. 


6/13 


The upgrade took place in July 201 1, as planned. We 
are planning to implement a Smart Hire template for 
Student employees and allow departments to process 
terminations through Manager Self Service (MSS) 
rather than a paper PAF. We have provided access to 
the system for new employees and HR 30 days prior to 
hire date. 


6 


UM 
System- 
wide 

Risk: 
Medium 


Human 

Resources Pre- 
Implementation 
Assessment, 
May 2010 

Report 

Observation: 4a 


Most of the campuses have centralized orientation 
processes, but not all campuses use that opportunity to 
input or verify employee data in the system, particularly 
for faculty new hires. Campuses will consider this practice 
along with several other leading practices such as 
establishment of Core Administrative Processing Services 
(CAPS) where appropriate or, as stated above, 
implementation of the manager self-service functionality 
within departments. 


5/io 
6/13 


The upgrade took place in July 201 1, as planned. We 
are planning to allow departments to process 
terminations through Manager Self Service (MSS). 
We have provided access to the system for new 
employees and HR 30 days prior to hire date. 

Human Resource Services (MU) has expanded its 
Core Administrative Processing Services (CAPS) 
centers. For the peak processing period from August 
through September, MU has expanded its new 
employee registration sessions from 2 sessions per day 
to 7 sessions per day. 

Our goal is to implement the MSS project by June 30, 
2013. 
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# 


Unit & 
Risk 


Audit Report 


Summary of Action Item 


Due Date 


Status Update 


7 


UM 

System- 
wide 

Risk: 
Medium 


Human 

Resources Pre- 
Implementation 
Assessment, 
May 2010 

Report 

Observation: 4b 


Campuses who do not already do so will prioritize the 
processing of new hire and termination PAF's so that 
Federal Regulations (E-Verify) are met, new employees 
receive their first paychecks timely, and terminations are 
processed timely. As stated above, system-wide standards 
will be developed to ensure these goals are met. Current 
personnel action workflow will be evaluated and 
appropriate resource allocation will be made with the 
desired outcome of effective, efficient, and timely 
processing of all personnel transactions. 


43/44) 
43/44- 
12/12 


Campuses continue to prioritize the processing of new 
hire and terminations PAF's. Human Resources 
Council (HRC) has identified implementing Manager 
Self Service (MSS) and eliminating the paper PAF for 
new hires as a priority project post go-live for HCM 
9. 1 . We have provided access to the system for new 
employees and HR 30 days prior to hire date. 

The upgrade took place in July 201 1, as planned. An 
electronic version of the PAF is being developed by a 
third party and will be fully integrated into the 
PeopleSoft system. Initial implementation is scheduled 
for January 2013 with additional forms / processes to 
be included over time. 


8 


UM 
System 

Risk: 


Division of 

Information 

Technology 

Project 

Management 

Office, July 2010 

Rertort 

Observation: la 


The Division of IT deployed Microsoft Project Server in 
December 2009 to facilitate the collection of work 
information and provide metrics on resource allocation. As 
the learning curve for the Project Server tool is steep, 
adoption has been gradual. Beginning July 1, 2010, 
Division of IT Project Managers (PMs) began assigning 
resources to selected projects; additionally, all Division of 
IT staff are now required to record time spent completing 
tasks. Beginning September 1, 2010, PMs will assign 
resources for all tasks in all projects. Additionally, 
Division of IT managers have identified the percentage 
availability for each human resource. 

Depending on our success in deploying Project Server and, 
assuming we have sufficient resources, we may implement 
Project Portfolio Server (PPM) in 201 1 . As part of that 
implementation process, we will interview senior 
executives and other stakeholders to capture their high- 
level metric needs. 


43/44- 
9/13 


Division of IT project resources are now managed in 
Project Server 2007. Projects include both those 
approved by DoIT's Project Governance Committee 
(PGC) and smaller projects not requiring PGC 
approval. 

Due to resource limitations, the project to install the 
new version of Microsoft Enterprise Project 
Management (EPM) 2010, which encompasses both 
routine project management and portfolio management 
has been delayed. In the meantime and in conjunction 
with the Strategic PMO initiative begun in 201 1, 
management is evaluating the use of Microsoft's 
Project Portfolio Management 2007 to optimize 
strategic UM System- wide projects within resource 
constraints. PPM will incorporate a high-level 
budgetary and other resource view for decision making, 
while linking detail resource information collected 
from actual project implementations. 
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# 


Unit & 
Risk 


Audit Report 


Summary of Action Item 


Due Date 


Status Update 


9 


UM 
System 

Risk: 


Division of 

Information 

Technology 

Project 

Management 

Office, July 2010 

Report 

Observation: 2a 


This recommendation is in progress with the 
implementation of MS Project Server and the possible 
future deployment of MS PPM Server. If implemented, 
PPM will provide more information on project 
prioritization readily available to publish and share with 
stakeholders. 

If PPM is not implemented, we will use some combination 
of printed reports, dashboards, and live meetings to 
improve transparency in the project approval and 
prioritization process. 


9/13 


During 201 1, the Vice Presidents of IT, HR, and 
Finance initiated an effort to define and build a 
strategic project management office (SPMO) at UM 
System level. A consultant has been hired to facilitate 
the process and the development of a strategic portfolio 
is underway. The use of a software management tool to 
manage and share priorities for executive decision 
making is under evaluation. The deployment date for 
the 2010 version of EPM (i.e. Project Server and 
Project Portfolio Server) is September 2013. We are 
currently reviewing the schedule to find shortcuts to 
speed deployment. Until then we are considering use of 
Project Portfolio Server 2007, which is in production. 


10 


Missouri 
S&T 

Risk: 
Medium 


Missouri S&T 
Office of the 
Vice Provost for 
Academic 
Affairs, April 
2011 

Report 

Observation: 2 


The original vision for the office suggested by the 
Restructuring Planning Committee in 2007 and current 
operations will be reviewed with the Provost. The focus of 
this review will be to clarify duties, responsibilities and 
delegated authority with a goal of identifying possible 
gains in efficiency through changing processes. Changes 
in processes and duties that are identified will be adopted 
for the Spring 2012 semester or before. 


6/12 
6/13 


From 9/1/1 1 until 4/1/12, both the Provost and the Vice 
Provost for Academic Affairs (VPAA) positions were 
filled on an interim basis. The VPAA position 
continues to be. 

A search process is now underway but it could be a few 
months until position is filled. Due to the interaction 
between VPAA and Provost on this issue and its 
nature, it seems best to allow time for the position to be 
filled on a long term basis and for that VPAA to have 
time to analyze and discuss the issue with the Provost. 
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# 


Unit & 
Risk 


Audit Report 


Summary of Action Item 


Due Date 


Status Update 


11 


MUHS 
Risk: 


University 
Physicians - 
Physician 
Documentation, 
November 2010 

Report 

Observation ' 3 


Management agrees with the recommendations regarding 
enhancements to coding and documentation training, 
reference materials, policies and intranet repositories, and 
the Compliance Resource "helpline". We will review 
further to define and implement appropriate enhancements 
that will address the risks identified. 


3/12 
9/12 
12/12 


The UP Professional Liability and Compliance 
Committee (PLCC) has renewed their contract with 
eHealthcarelT to provide online education and testing 
for physicians, residents and fellows. Currently, the 
PLCC is discussing adding coder/biller coursework to 
this tool. Providers and their administrators/ coding 
staff will continue to receive one-on-one education, 
and TIP has contracted with a vendor to nrovide 

CL11U V 1 lltl.l ^_ V_' 1 1 1 1 CI V- L ^ VV 1 111 CI V ^llvlVll IV_' LllVlVlvlVj 

specialty specific education. 

The OCC maintains an intranet website with the 
policies for coding and documentation. Also, MUHC 
has begun fully utilizing the University of Missouri 
System Ethics and Compliance Hotline which includes 
financial, medical and health, human resources, 
research, athletics, and environmental, health and 
safety areas. MUHC has designed a promotional 
communication plan to increase awareness of the 
hotline throughout the institution. 


12 


MUHS 

Risk: 
Medium 


University 
Physicians - 
Physician 
Documentation, 
November 2010 

Report 

Observation: 4 


We will review our documentation policies and procedures 
to ensure that MUHS documentation standards are aligned 
with Medicare standards. We will make appropriate 
improvements to our policies and monitoring activities to 
address the risks identified above. 


7/H- 
3/12 

8/12 
12/12 


The Professional Liability Sub-Committee on 
Documentation Guidelines has presented draft 
recommendations to the Professional Liability and 
Compliance Committee (PLCC) for review. The final 
guidelines will be reviewed and approved by the UP 
Management Committee. 

Monitoring tools, policies and procedures for 
monitoring documentation/signature deficiencies and 
reporting mechanisms, and the establishment of 
monitoring timelines and responsibilities for 
monitoring activities will be developed. 
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# 


Unit & 
Risk 


Audit Report 


Summary of Action Item 


Due Date 


Status Update 


13 


MUHS 
Risk: 


MUHS ICD-10 
Internal Audit 
Analvsis Tulv 
2011 

Report 

Observation: 1 


MUHC concurs with the recommendations of completing a 
comprehensive assessment, developing a project plan, and 
develortin? a rtroiect management structure to j?ovem the 
plan. The components of the assessment will be defined 
upon engagement of a consultant along with a project plan. 


3/12 
12/12 


Deloitte Consulting completed an assessment of the 
impact of transition from ICD-9 to ICD-10. 
Recommendations are being reviewed to develop an 
implementation timeline pending an announcement 
from the Centers of Medicare and Medicaid Services 
(CMS) regarding a final ICD-10 implementation date. 


14 


MUHS 

Risk: 
Medium 


MUHS ICD-10 
Internal Audit 
Analvsis Tulv 
2011 

Report 

Observation: 2 


MUHC will expand the education plan upon completion of 
the assessment noted in recommendation 1 . 


3/12 
12/12 


Hospital staff has completed the Anatomy and 
Physiology refresher course. A plan for specific ICD- 
10 training is on hold until a final implementation date 
is announce by CMS. 


15 


MUHS 

Risk: 
Medium 


MUHS ICD-10 
Internal Audit 
Analysis, July 
2011 

Report 

Observation: 3 


MUHC agrees with the recommendation for a complete IT 
assessment. This is included in the consulting engagement. 


3/12 
12/12 


A technology assessment was provided in the report 
completed by Deloitte Consulting. A mitigation of 
vendor applications is ongoing. 
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